Running Jazzer on ARM (specifically Android phones)

[MHA3]

Hi, I recently tried to build and run Jazzer on a physical device but got an error saying:

./data/jazzer_bin_copy/jazzer[11]: ./data/jazzer_bin_copy/jazzer_driver: not executable: 64-bit ELF file

I did file on it and got:

$ file jazzer_driver
jazzer_driver: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=13ea3a687dc35e6f, with debug_info, not stripped

It seems like it is built for x86 currently. Is there work in progress to build jazzer for ARM?
Or is there another way to run jazzer on ARM?

[fmeum]

I have never tried running Jazzer on ARM. While Jazzer does use a small snippet of inline assembler (https://github.com/CodeIntelligenceTesting/jazzer/blob/main/driver/sanitizer_hooks_with_pc.cpp), porting it to ARM shouldn't be too difficult. The main challenge would be to figure out how to launch or attach to a JVM on Android. Is there an equivalent of libjvm.so on Android?

Could you provide more details on how you have tried to build Jazzer for Android?

[MHA3]

Instead of focusing too much on ARM, I decided to try to run jazzer on an x86_64 emulator.

After building jazzer, I ran patchelf --set-interpreter /system/bin/linker64 jazzer because on Android the linker is at a different place. Then moved it to the emulator. Then got error: Android 5.0 and later only support position-independent executables (-fPIE)..

I tried looking for a config which could be disabling pic in various BUILD.bazel configs. But couldn't figure out why a PIE executable wasn't being generated...

I previously tried doing values = {"force_pic": "true"} under config_setting but that didn't work...

[fmeum]

With such a config_setting, you would not set force_pic, but make it possible for e.g. selects to depend on its value. Could you try again with:

bazel build //:jazzer --force_pic

This gives me:

❯ file bazel-bin/driver/jazzer_driver
bazel-bin/driver/jazzer_driver: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=18d2f7b0ad33a53e, with debug_info, not stripped

[MHA3]

So, even after doing force_pic, the binary still didn't work, the error message read:

CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable

I tried following bazel instructions, and ran this command to try building via the NDK (after setting up prerequisites):

./bazelisk-linux-amd64 build //:jazzer_release --force_pic       --crosstool_top=@androidndk//:default_crosstool       --cpu=x86_64       --host_crosstool_top=@bazel_tools//tools/cpp:toolchain

The resulting binary gave the same errors as without using the NDK.

I also tried to gather the required libraries for my android fuzz target on the host to try and see if I can fuzz it using jazzer locally on x86 linux, but got this error:

Java Exception: java.lang.UnsatisfiedLinkError: 'boolean android.util.Log.isLoggable(java.lang.String, int)'

It's a native method compiled as the target libandroid_runtime, I tried to make it available to the binary at runtime by putting libandroid_runtime.so in the same directory as my compiled fuzz target .class, and trying to provide the path to it as:

Djava.library.path="./lib"

where the .so files were added to the ./lib directory.
But still ran into the same UnsatisfiedLinkError.

[fmeum]

So, even after doing force_pic, the binary still didn't work, the error message read:

CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable

Did you try this with current main? We dropped the dependency on libdl in 554bfe4.

It's a native method compiled as the target libandroid_runtime, I tried to make it available to the binary at runtime by putting libandroid_runtime.so in the same directory as my compiled fuzz target .class, and trying to provide the path to it as:

Djava.library.path="./lib"

where the .so files were added to the ./lib directory. But still ran into the same UnsatisfiedLinkError.

How did you pass this argument to Jazzer? Since Jazzer launches its own JVM, you might have to pass it via --jvm_args. Alternatively, if this is available on Android, you could add ./lib (or ideally an absolute path) to LD_LIBRARY_PATH or even LD_PRELOAD the native library.

[MHA3]

1. Reset my local repo to main, but still got the libdl.so.2 not found error.

2. Even after adding ./lib to LD_LIBRARY_PATH, still got UnsatisfiedLinkError.

3. I tried running jazzer with --jvm_args=-Djava.library.path= ".../lib/libandroid_runtime.so". It showed me ./jazzer: Running 1 inputs 1 time(s) each. Running: ...s/lib/libandroid_runtime.so, but still got the UnsatisfiedLinkError eventually.

4. Adding the library's absolute path to LD_PRELOAD also didn't work.

I think the 2 most promising ideas may be using robolectric alongside jazzer, or building jazzer for android. Still a bit surprised why using the ndk to build jazzer didn't work previously.